Suricata

Thanks for the feedback Jason.

Here is a little extra context. For our organization we are running in IPS mode, and are interested in triggering on any potential record in a DNS response message that could match our signatures / datasets.
Needing to reference every individual field for each section will add complexity and replication to our signature set.
For example, we want to match on:

• question section: name field
• answer, authority, additional sections: name and rdata fields
  This would be seven unique fields, which would translate to seven signatures just for DNS response traffic (even more if we want to have different signature / action combinations). It would be much simpler to have a generic way to fully match a DNS response.

I can see value in both implementations. Exposing unique fields for those who want to write a specific signature, but also having the option to match against all fields easily for those who want to match on everything possible in a response with a single signature.

The name isn't important, we could change that if you feel dns.response is too open. It seemed to me like a nice description, as the result is matching on the entire DNS response.